Modem software applications are designed to be modular, distributed, and interconnected. Some advanced software systems go a step further and divide complex applications into micro-services. Micro-services refer to software architectures in which complex applications are composed of many small, independent processes communicating with one another. Micro-services enable unprecedented efficiency and flexibility. However, micro-services architectures create a host of new security challenges, and so a new security solution is required. The ideal solution will leverage the advantages of the micro-services approach and properly protect both micro-services and traditional systems. As used herein, the term application includes a traditional monolithic code stack forming an application and a micro-services instantiation of an application.
Application containers provide compute capabilities that dramatically improve scalability, efficiency, and resource usage. Application containers are sometimes called containers, software containers, virtualization engines or operating-system level virtualization. Any such container packages an application and all of its dependencies as an isolated process in the user space of an operating system. An operating system kernel uses technologies, such as name spaces and cgroups, to enforce isolation between containers.
Containers can be run in on-premises data centers, private cloud computing environments, public cloud computing environments and on both bare metal servers and virtual machines. Containers are designed to be portable across different computing infrastructure environments, isolate applications from one another and enable improved resource utilization and management.
Containers are one of the main building blocks in micro-services systems, and are particularly easy to migrate across networks. Unfortunately, securing containers themselves, the applications that run within them, and the software infrastructure surrounding the containers, is a new challenge that has not yet been met. Accordingly, a new security solution is needed, ideally delivered within containers for efficiency and portability, while protecting the software infrastructure and containers that are used to run applications.